In short
Free DNS protection does exist: eligible UK public sector organisations and schools can use the NCSC's free PDNS, and free home services such as OpenDNS filter some threats. For most businesses, free services lack per-user policy, off-site protection, reporting and contractual support, so a free trial of a paid service is usually the better starting point.
Get a quote for DNS security
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
The free DNS protection options
"Free" covers three quite different things: a government service for organisations that qualify, consumer DNS services aimed at homes, and time-limited trials of business services. This table sets them side by side.
| Option | Who it is for | What it does | The catch |
|---|---|---|---|
| NCSC PDNS | Central government and other organisations the NCSC deems eligible | Blocks domains known to be malicious; dashboards, logs and SIEM connectors; PDNS Roaming for Windows, macOS and iOS | Only for eligible organisations; security blocking, not content filtering |
| PDNS for Schools | All UK schools, since October 2024 | The NCSC's protective DNS for schools, blocking malware, ransomware, spyware and phishing domains | The NCSC says it complements, but does not replace, safeguarding filtering |
| OpenDNS Home, FamilyShield and Public Service | Homes and small businesses, as opendns.com puts it | Free public resolvers; FamilyShield is preconfigured to block adult content and OpenDNS Home offers customisable filtering | Not covered by Cisco's Umbrella terms or service levels; Cisco points enterprises to Secure Access |
| Free trials of paid services | Any organisation evaluating a service | The full paid product for a limited period | Protection stops when the trial ends unless you buy |
Free consumer DNS is not useless. Pointing a home router at a filtering resolver is a sensible step for a household. The question for an organisation is whether it gives you a control you can manage, prove and get help with. Our guide to OpenDNS and Cisco Umbrella explains the OpenDNS services in detail, including why Cisco's Umbrella terms do not cover a business's use of the free service.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Free trials of DNS security services
A trial gives you the real product on your own traffic, which is far more useful than reading data sheets. These are the trials we checked on the vendors' own sites in November 2026:
| Service | Trial the vendor offers | Worth knowing |
|---|---|---|
| Cisco Umbrella | 14 days, no credit card required | Umbrella's last day to order is 31 January 2027; see our Cisco Umbrella free trial guide |
| Cisco Secure Access DNS Defense | 14 days, linked from Cisco's Umbrella site | Cisco's successor to Umbrella DNS; see DNS Defense vs Umbrella |
| DNSFilter | 14 days, with access to all generally available capabilities | Plans are Core, Plus and Enterprise; see Cisco Umbrella vs DNSFilter |
| Webroot DNS Protection | 30 days, advertised on Webroot's DNS Protection page | Needs Webroot Business Endpoint Protection when you buy; see Webroot DNS Protection explained |
Trial terms are set by each vendor and can change, so check the current offer before you start; we can confirm it with the vendor for you. If you run the trial with us, we can help you set it up and, if you decide to go ahead, arrange the subscription.
Is free DNS filtering enough for a business?
For a household, often yes. For a business, usually not, and the NCSC's guidance on protective DNS for the private sector explains why better than we can. It asks organisations to look for:
- A trusted provider with regularly updated threat intelligence. Free services may block threats, but you have no assurance about how their lists are kept current.
- Privacy assurances. A DNS service sees every lookup your network makes. The NCSC suggests considering providers that give assurances about how they use and protect your data, and notes that this may not be possible with freely available services.
- A service level agreement. DNS is critical: if it fails, nothing works. The NCSC says you should have an SLA and check the provider has appropriate failover.
- Logs you can use. The NCSC says analysis of blocked requests should be incorporated into your SIEM so you can investigate incidents.
- Protection off site. The NCSC notes that services may offer a lightweight client so roaming and home devices still resolve through the protective resolvers.
There is also a practical point. If a cyber insurer, auditor or customer questionnaire asks how you protect web access, a configured, supported service with reports is much easier to evidence than a free resolver set on an office router some years ago.
Is DNS security the right fit for you?
We will check it against your systems and requirements and recommend the right option.
What paid DNS security adds
| Capability | Free consumer DNS (typical) | Paid business DNS security |
|---|---|---|
| Blocking of known-malicious domains | Some, depending on the service | Yes, from the vendor's threat intelligence |
| Content categories you choose | Limited, often whole-network presets | Categories set per network, group or user |
| Policy by user or group | No | Yes, usually with Microsoft Entra ID or Active Directory |
| Protection off the office network | Not designed for it | Roaming clients or agents on laptops and, with some services, mobiles and Chromebooks |
| Reporting and log export | Basic or none | Dashboards, scheduled reports, APIs and SIEM export, depending on plan |
| Controls for encrypted DNS bypass | No | Category blocking of DNS over HTTPS services and roaming clients that keep lookups on the protective resolver, depending on the service |
| Advanced detection | No | For example, Cisco Secure Access DNS Defense adds AI-based detection of DNS tunnelling and algorithmically generated domains |
| Support and contractual terms | No business support contract | Vendor terms and support, plus our help |
None of that comes free, but for a simple network the NCSC says switching to protective DNS should be very simple, with very little set-up cost, and it protects every application on a device rather than just the browser. Our DNS security solutions page compares the services we supply, and encrypted DNS explains why bypass controls matter.
Is there a free web filter for schools?
Schools often search for the best free web filter. The honest answer has two parts.
The NCSC's PDNS for Schools is free and, since October 2024, offered to all UK schools. It is a valuable security layer that blocks known-malicious domains, but the NCSC itself says it complements, but does not replace, the safeguarding filtering schools should already have in place. The Department for Education's filtering and monitoring standards expect a filtering system that blocks harmful and inappropriate content, with at least separate student and staff profiles, a log of regular checks and a review at least once a year. See PDNS for Schools for how it fits.
Schools therefore need a filtering service as well as PDNS, whether it comes through a local authority, broadband consortium or trust, or is bought directly. Our guide to web filtering for schools covers the options, and the school web filter test explains how to check whatever you use is working.
How to get the most from a free trial
- Decide what you are testing. Security blocking only, content filtering, off-site protection, or all three. Agree the success criteria before you start.
- Start with one network. Point one office's DNS at the service, or forward from your internal DNS servers, and register the network in the dashboard.
- Add a pilot group of laptops with the roaming client so you see protection off site. See DNS roaming clients.
- Check for bypass. Make sure browsers are not sending lookups to their own DNS over HTTPS resolvers. See should you block DNS over HTTPS?
- Test that blocking works using the vendor's published test domains and the checks in our DNS security test guide.
- Review the reports after a few days of real traffic: blocked threats, top categories and any wrongly blocked sites.
- Decide before the trial ends, and have a plan for anything you pointed at the service, because protection stops when the trial does.
We can run a trial with you, set up the network and roaming pieces, and go through the reports together. Contact us to get started; for paid services, ask us for a quote.
How Forever Systems helps with DNS security
We are an independent UK IT and cyber security provider and a Cisco Partner. We supply Cisco Umbrella and Cisco Secure Access DNS Defense, and a range of other DNS filtering options, so we can recommend what fits rather than one answer for everyone.
- Start with what you have: we look at your firewall, endpoint protection and Microsoft 365 licences first, as some already include DNS or web filtering
- Choosing a service: Cisco DNS-layer security, DNS filtering bundled with endpoint protection, or a protective DNS service from the public sector, compared in plain English
- Set-up and roll-out: network forwarding, roaming clients for laptops off site, policies, block pages and controls to stop encrypted DNS bypassing the filter
- Migration help, including planning a move from Umbrella DNS packages to Cisco Secure Access DNS Defense
- Ongoing help: policy changes, reporting reviews, licence management and renewals, agreed at quote
We work with businesses, schools, charities and public sector organisations.
Frequently asked questions
Is there free DNS protection for business?
Some. Free consumer services such as OpenDNS Home offer basic protection and customisable filtering, and free trials let you use paid services for a limited time. Eligible organisations, including UK schools, can use the NCSC's free PDNS. For most businesses, free services lack the policy, off-site protection, reporting and support that make DNS security a dependable control.
Is OpenDNS still free?
Yes. opendns.com lists OpenDNS Home, OpenDNS FamilyShield and the OpenDNS Public Service as free. The site points organisations looking for enterprise security to Cisco Secure Access, and Cisco's Umbrella terms do not cover a business's use of the free service.
Is NCSC PDNS free?
Yes, for organisations that are eligible. The NCSC says PDNS is centrally funded, so there is no charge. It is mandated for central government departments and available to other organisations that meet the NCSC's criteria, and PDNS for Schools has been offered to all UK schools since October 2024.
What do paid DNS security services add?
Policies by user and group, roaming clients for devices off site, reporting and log export to your SIEM, controls for encrypted DNS bypass, your own allow and block lists, vendor support and contractual terms. Some, such as Cisco Secure Access DNS Defense, add detection of DNS tunnelling and algorithmically generated domains.
Is there a free web filter for schools?
The NCSC's PDNS for Schools is free for UK schools and blocks known-malicious domains, but the NCSC says it complements rather than replaces safeguarding filtering. Schools still need filtering that meets the Department for Education's filtering and monitoring standards, alongside PDNS.
How long are DNS filtering free trials?
It depends on the vendor. Cisco's Umbrella and Secure Access DNS Defense trials are 14 days, DNSFilter's is 14 days, and Webroot advertises a 30-day DNS Protection trial. Vendors can change their trial terms, so check the current offer before you start; we can confirm it for you.
Still have a question about DNS security?
Ask us and a member of our team will reply by email.